| Vulnerability Name: | CVE-2018-16477 (CCN-153531) | ||||||||||||||||||||||||||||||||||||||||||||||||
| Assigned: | 2018-11-27 | ||||||||||||||||||||||||||||||||||||||||||||||||
| Published: | 2018-11-27 | ||||||||||||||||||||||||||||||||||||||||||||||||
| Updated: | 2019-10-09 | ||||||||||||||||||||||||||||||||||||||||||||||||
| Summary: | A bypass vulnerability in Active Storage >= 5.2.0 for Google Cloud Storage and Disk services allow an attacker to modify the `content-disposition` and `content-type` parameters which can be used in with HTML files and have them executed inline. Additionally, if combined with other techniques such as cookie bombing and specially crafted AppCache manifests, an attacker can gain access to private signed URLs within a specific storage path. This vulnerability has been fixed in version 5.2.1.1. | ||||||||||||||||||||||||||||||||||||||||||||||||
| CVSS v3 Severity: | 6.5 Medium (CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N) 5.7 Medium (Temporal CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N/E:U/RL:O/RC:C)
4.6 Medium (CCN Temporal CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N/E:U/RL:O/RC:C)
| ||||||||||||||||||||||||||||||||||||||||||||||||
| CVSS v2 Severity: | 4.3 Medium (CVSS v2 Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N)
| ||||||||||||||||||||||||||||||||||||||||||||||||
| Vulnerability Type: | CWE-noinfo | ||||||||||||||||||||||||||||||||||||||||||||||||
| Vulnerability Consequences: | Bypass Security | ||||||||||||||||||||||||||||||||||||||||||||||||
| References: | Source: MITRE Type: CNA CVE-2018-16477 Source: CCN Type: Active Storage Web site Active Storage Source: XF Type: UNKNOWN active-storage-cve201816477-sec-bypass(153531) Source: MISC Type: Exploit, Mailing List, Mitigation, Third Party Advisory https://groups.google.com/d/msg/rubyonrails-security/3KQRnXDIuLg/mByx5KkqBAAJ Source: CCN Type: oss-sec Mailing List, Tue, 27 Nov 2018 16:11:36 -0500 [CVE-2018-16477] Bypass vulnerability in Active Storage Source: MISC Type: Vendor Advisory https://weblog.rubyonrails.org/2018/11/27/Rails-4-2-5-0-5-1-5-2-have-been-released/ Source: CCN Type: WhiteSource Vulnerability Database CVE-2018-16477 | ||||||||||||||||||||||||||||||||||||||||||||||||
| Vulnerable Configuration: | Configuration 1: Denotes that component is vulnerable | ||||||||||||||||||||||||||||||||||||||||||||||||
| Oval Definitions | |||||||||||||||||||||||||||||||||||||||||||||||||
| |||||||||||||||||||||||||||||||||||||||||||||||||
| BACK | |||||||||||||||||||||||||||||||||||||||||||||||||